@bitkyc08/opencodex 2.8.0 → 2.9.0

package/src/adapters/cursor/native-exec.ts

@@ -1,8 +1,10 @@
 import { createHash } from "node:crypto";
+import { enforceAppOwnedMemoryBudget } from "../../lib/app-owned-memory";
 import { create } from "@bufbuild/protobuf";
 import {
   DiagnosticsErrorSchema,
   DiagnosticsResultSchema,
+  ErrorSchema,
   GetBlobResultSchema,
   KvClientMessageSchema,
   McpErrorSchema,
@@ -60,6 +62,8 @@ export type CursorNativeExecDeps = CursorNativeNetworkDeps & CursorNativeToolDep
  * never told any MCP tools exist, so it never sends `mcpArgs`.
  */
 export interface CursorNativeExecContext extends CursorNativeExecDeps {
+  /** Stable owner for background shells created by this transport session. */
+  sessionId?: string;
   mcpToolDefs?: McpToolDefinition[];
   clientToolDefs?: McpToolDefinition[];
   /** Unsafe opt-in escape hatch for Cursor server-driven local fs/shell/fetch execution. */
@@ -80,42 +84,245 @@ export function cursorUnsafeNativeLocalExecEnabled(input: Pick<CursorNativeExecC
  * their blobs on every turn (`rootPromptMessages` → `storeCursorBlob`), so TTL + cap eviction is
  * safe for live sessions: only genuinely abandoned entries age out.
  */
-const BLOB_TTL_MS = 15 * 60 * 1000;
-const BLOB_MAX_ENTRIES = 4096;
-const blobs = new Map<string, { data: Uint8Array; storedAt: number }>();
-
-function evictStaleBlobs(now: number): void {
-  if (blobs.size <= BLOB_MAX_ENTRIES) {
-    // TTL sweep only when the map has any chance of stale entries; Map iterates insertion order.
-    for (const [k, entry] of blobs) {
-      if (now - entry.storedAt <= BLOB_TTL_MS) break;
-      blobs.delete(k);
+const BLOB_TTL_MS = 15 * 60_000;
+const BLOB_MAX_ENTRIES = 4_096;
+const BLOB_MAX_ENTRY_BYTES = 16 * 1024 * 1024;
+export const CURSOR_BLOB_MAX_TOTAL_BYTES = 64 * 1024 * 1024;
+
+type CursorBlobProvenance = "local-regenerated" | "remote-setBlobArgs";
+export type CursorBlobRequestScopeToken = symbol;
+
+interface CursorBlobEntry {
+  data: Uint8Array;
+  storedAt: number;
+  sizeBytes: number;
+  provenance: CursorBlobProvenance;
+  requestPins: Set<CursorBlobRequestScopeToken>;
+}
+
+type CursorBlobRejectionReason = "entry_too_large" | "pinned_saturation" | "request_pinned_conflict";
+type CursorBlobAdmission =
+  | { admitted: true; replaced: boolean }
+  | { admitted: false; reason: CursorBlobRejectionReason };
+
+interface CursorBlobLimits {
+  ttlMs: number;
+  maxEntries: number;
+  maxEntryBytes: number;
+  maxTotalBytes: number;
+}
+
+interface CursorBlobRequestScopeState {
+  keys: Set<string>;
+  sealed: boolean;
+}
+
+const DEFAULT_BLOB_LIMITS: CursorBlobLimits = {
+  ttlMs: BLOB_TTL_MS,
+  maxEntries: BLOB_MAX_ENTRIES,
+  maxEntryBytes: BLOB_MAX_ENTRY_BYTES,
+  maxTotalBytes: CURSOR_BLOB_MAX_TOTAL_BYTES,
+};
+
+const blobs = new Map<string, CursorBlobEntry>();
+const blobRequestScopes = new Map<CursorBlobRequestScopeToken, CursorBlobRequestScopeState>();
+let blobLimits = { ...DEFAULT_BLOB_LIMITS };
+let blobBytes = 0;
+let blobLocalBytes = 0;
+let blobPinnedBytes = 0;
+let blobEvictableBytes = 0;
+let blobOldestEvictableAt: number | null = null;
+let rejectedEntryTooLarge = 0;
+let rejectedPinnedSaturation = 0;
+let blobExpiryAccountingTimer: ReturnType<typeof setTimeout> | undefined;
+
+function isExpired(entry: CursorBlobEntry, now: number): boolean {
+  return now - entry.storedAt >= blobLimits.ttlMs;
+}
+
+function bytesEqual(a: Uint8Array, b: Uint8Array): boolean {
+  if (a.byteLength !== b.byteLength) return false;
+  for (let i = 0; i < a.byteLength; i++) if (a[i] !== b[i]) return false;
+  return true;
+}
+
+function recomputeBlobClassAccounting(): void {
+  const now = Date.now();
+  let localBytes = 0;
+  let pinnedBytes = 0;
+  let evictableBytes = 0;
+  let oldestAt: number | null = null;
+  for (const entry of blobs.values()) {
+    const requestPinned = entry.requestPins.size > 0;
+    const provenancePinned = entry.provenance === "remote-setBlobArgs" && !isExpired(entry, now);
+    if (entry.provenance === "local-regenerated") localBytes += entry.sizeBytes;
+    if (requestPinned || provenancePinned) pinnedBytes += entry.sizeBytes;
+    if (!requestPinned && (entry.provenance === "local-regenerated" || isExpired(entry, now))) {
+      evictableBytes += entry.sizeBytes;
+      oldestAt = oldestAt === null ? entry.storedAt : Math.min(oldestAt, entry.storedAt);
     }
-    return;
   }
-  // Over cap: drop oldest entries first (insertion order approximates recency because re-stores
-  // delete+set to refresh their position).
-  const excess = blobs.size - BLOB_MAX_ENTRIES;
-  let dropped = 0;
-  for (const k of blobs.keys()) {
-    if (dropped >= excess) break;
-    blobs.delete(k);
-    dropped++;
+  blobLocalBytes = localBytes;
+  blobPinnedBytes = pinnedBytes;
+  blobEvictableBytes = evictableBytes;
+  blobOldestEvictableAt = oldestAt;
+  scheduleBlobExpiryAccounting(now);
+}
+
+function reconcileBlobClassAccountingAndEnforce(): void {
+  recomputeBlobClassAccounting();
+  enforceAppOwnedMemoryBudget();
+}
+
+function scheduleBlobExpiryAccounting(now: number): void {
+  if (blobExpiryAccountingTimer) clearTimeout(blobExpiryAccountingTimer);
+  blobExpiryAccountingTimer = undefined;
+  let nextExpiry = Number.POSITIVE_INFINITY;
+  for (const entry of blobs.values()) {
+    if (entry.provenance !== "remote-setBlobArgs" || entry.requestPins.size > 0) continue;
+    const expiresAt = entry.storedAt + blobLimits.ttlMs;
+    if (expiresAt > now) nextExpiry = Math.min(nextExpiry, expiresAt);
+  }
+  if (!Number.isFinite(nextExpiry)) return;
+  blobExpiryAccountingTimer = setTimeout(() => {
+    blobExpiryAccountingTimer = undefined;
+    reconcileBlobClassAccountingAndEnforce();
+  }, Math.max(0, nextExpiry - now));
+  blobExpiryAccountingTimer.unref?.();
+}
+
+function deleteBlob(k: string, recompute = true): number {
+  const entry = blobs.get(k);
+  if (!entry) return 0;
+  blobs.delete(k);
+  blobBytes -= entry.sizeBytes;
+  for (const scope of entry.requestPins) blobRequestScopes.get(scope)?.keys.delete(k);
+  if (recompute) recomputeBlobClassAccounting();
+  return entry.sizeBytes;
+}
+
+function releaseHydratedBlob(k: string, requestScope?: CursorBlobRequestScopeToken): void {
+  const entry = blobs.get(k);
+  if (!entry) return;
+  const scopes = requestScope ? [requestScope] : [...entry.requestPins];
+  let changed = false;
+  for (const scope of scopes) {
+    if (!entry.requestPins.delete(scope)) continue;
+    changed = true;
+    const state = blobRequestScopes.get(scope);
+    state?.keys.delete(k);
+    if (state?.sealed && state.keys.size === 0) blobRequestScopes.delete(scope);
   }
+  if (changed) reconcileBlobClassAccountingAndEnforce();
 }
 
-function setBlob(k: string, data: Uint8Array): void {
+function setBlob(
+  k: string,
+  data: Uint8Array,
+  provenance: CursorBlobProvenance,
+  requestScope?: CursorBlobRequestScopeToken,
+): CursorBlobAdmission {
+  if (data.byteLength > blobLimits.maxEntryBytes) {
+    rejectedEntryTooLarge++;
+    return { admitted: false, reason: "entry_too_large" };
+  }
+
   const now = Date.now();
-  blobs.delete(k); // refresh insertion order so live sessions stay newest
-  blobs.set(k, { data, storedAt: now });
-  evictStaleBlobs(now);
+  const existing = blobs.get(k);
+  const sameData = existing ? bytesEqual(existing.data, data) : false;
+  if (existing && !sameData && existing.requestPins.size > 0) {
+    return { admitted: false, reason: "request_pinned_conflict" };
+  }
+
+  const removals = new Set<string>();
+  for (const [candidateKey, entry] of blobs) {
+    if (candidateKey === k && sameData) continue;
+    if (entry.requestPins.size === 0 && isExpired(entry, now)) removals.add(candidateKey);
+  }
+
+  const existingRemovedByTtl = existing !== undefined && removals.has(k);
+  const reuseExisting = existing !== undefined && sameData && !existingRemovedByTtl;
+  const mergedProvenance: CursorBlobProvenance = reuseExisting && existing.provenance === "remote-setBlobArgs"
+    ? "remote-setBlobArgs"
+    : provenance;
+  const storedAt = reuseExisting && existing.provenance === "remote-setBlobArgs" && provenance === "local-regenerated"
+    ? existing.storedAt
+    : now;
+
+  let projectedBytes = blobBytes;
+  let projectedCount = blobs.size;
+  for (const candidateKey of removals) {
+    const entry = blobs.get(candidateKey);
+    if (!entry) continue;
+    projectedBytes -= entry.sizeBytes;
+    projectedCount--;
+  }
+  if (existing && !existingRemovedByTtl) {
+    projectedBytes -= existing.sizeBytes;
+    projectedCount--;
+  }
+  projectedBytes += data.byteLength;
+  projectedCount++;
+
+  if (projectedBytes > blobLimits.maxTotalBytes || projectedCount > blobLimits.maxEntries) {
+    const localVictims = [...blobs.entries()].sort((a, b) => a[1].storedAt - b[1].storedAt);
+    for (const [candidateKey, entry] of localVictims) {
+      if (
+        candidateKey === k
+        || removals.has(candidateKey)
+        || entry.requestPins.size > 0
+        || entry.provenance !== "local-regenerated"
+      ) continue;
+      removals.add(candidateKey);
+      projectedBytes -= entry.sizeBytes;
+      projectedCount--;
+      if (projectedBytes <= blobLimits.maxTotalBytes && projectedCount <= blobLimits.maxEntries) break;
+    }
+  }
+
+  if (projectedBytes > blobLimits.maxTotalBytes || projectedCount > blobLimits.maxEntries) {
+    rejectedPinnedSaturation++;
+    return { admitted: false, reason: "pinned_saturation" };
+  }
+
+  // Carry forward only pins whose scope still has live state; a dead scope's
+  // token can never be released again (review C1-1).
+  const requestPins = new Set<CursorBlobRequestScopeToken>();
+  if (reuseExisting) {
+    for (const scope of existing.requestPins) {
+      if (blobRequestScopes.has(scope)) requestPins.add(scope);
+    }
+  }
+  // A pin is only attached when the scope still has live UNSEALED state:
+  // sealing fixes the advertised key set (locked contract), so a remote
+  // setBlobArgs arriving after seal must not extend the pin set — and a
+  // sealed scope whose advertised keys have all hydrated is already deleted,
+  // so attaching its stale token would create a permanent untracked pin the
+  // terminal release could never clear (reviews C1-1/C2-1).
+  const scopeState = requestScope ? blobRequestScopes.get(requestScope) : undefined;
+  if (requestScope && scopeState && !scopeState.sealed) requestPins.add(requestScope);
+  const entry: CursorBlobEntry = {
+    data: reuseExisting ? existing.data : data.slice(),
+    storedAt,
+    sizeBytes: data.byteLength,
+    provenance: mergedProvenance,
+    requestPins,
+  };
+
+  for (const candidateKey of removals) deleteBlob(candidateKey, false);
+  if (blobs.has(k)) deleteBlob(k, false);
+  blobs.set(k, entry);
+  blobBytes += entry.sizeBytes;
+  for (const scope of entry.requestPins) blobRequestScopes.get(scope)?.keys.add(k);
+  reconcileBlobClassAccountingAndEnforce();
+  return { admitted: true, replaced: existing !== undefined };
 }
 
 function getBlob(k: string): Uint8Array | undefined {
   const entry = blobs.get(k);
   if (!entry) return undefined;
-  if (Date.now() - entry.storedAt > BLOB_TTL_MS) {
-    blobs.delete(k);
+  if (entry.requestPins.size === 0 && isExpired(entry, Date.now())) {
+    deleteBlob(k);
     return undefined;
   }
   return entry.data;
@@ -130,12 +337,136 @@ function key(bytes: Uint8Array): string {
  * blob id. Cursor's `rootPromptMessagesJson`/turn entries are blob IDS, not inline content — the
  * server fetches the bytes back via `getBlobArgs`. Mirrors jawcode `createBlobId`/`storeCursorBlob`.
  */
-export function storeCursorBlob(data: Uint8Array): Uint8Array {
+export class CursorBlobAdmissionError extends Error {
+  readonly code = "cursor_blob_capacity";
+
+  constructor(readonly reason: CursorBlobRejectionReason) {
+    super("Cursor blob capacity is exhausted; retry with a smaller request.");
+    this.name = "CursorBlobAdmissionError";
+  }
+}
+
+let blobScopeSequence = 0;
+
+export function createCursorBlobRequestScope(): CursorBlobRequestScopeToken {
+  // Unique description per token so debug snapshots expose exact pin
+  // IDENTITY, not just pin counts (review C2-2: identical descriptions made
+  // scope-swap bugs invisible to deep comparison).
+  const scope = Symbol(`cursor-blob-request-${++blobScopeSequence}`);
+  blobRequestScopes.set(scope, { keys: new Set(), sealed: false });
+  return scope;
+}
+
+export function sealCursorBlobRequestScope(scope: CursorBlobRequestScopeToken): void {
+  const state = blobRequestScopes.get(scope);
+  if (!state) return;
+  state.sealed = true;
+  if (state.keys.size === 0) blobRequestScopes.delete(scope);
+}
+
+export function releaseCursorBlobRequestScope(scope: CursorBlobRequestScopeToken): void {
+  const state = blobRequestScopes.get(scope);
+  if (!state) return;
+  for (const k of state.keys) blobs.get(k)?.requestPins.delete(scope);
+  blobRequestScopes.delete(scope);
+  reconcileBlobClassAccountingAndEnforce();
+}
+
+export function storeCursorBlob(data: Uint8Array, requestScope?: CursorBlobRequestScopeToken): Uint8Array {
   const blobId = new Uint8Array(createHash("sha256").update(data).digest());
-  setBlob(key(blobId), data);
+  const admission = setBlob(key(blobId), data, "local-regenerated", requestScope);
+  if (!admission.admitted) throw new CursorBlobAdmissionError(admission.reason);
   return blobId;
 }
 
+export interface CursorBlobMetrics {
+  count: number;
+  totalBytes: number;
+  localBytes: number;
+  pinnedBytes: number;
+  rejectedEntryTooLarge: number;
+  rejectedPinnedSaturation: number;
+  oldestAt: number | null;
+}
+
+export function cursorBlobMetrics(): CursorBlobMetrics {
+  return {
+    count: blobs.size,
+    totalBytes: blobBytes,
+    localBytes: blobLocalBytes,
+    pinnedBytes: blobPinnedBytes,
+    rejectedEntryTooLarge,
+    rejectedPinnedSaturation,
+    oldestAt: blobOldestEvictableAt,
+  };
+}
+
+export function cursorBlobRetainedStoreSnapshot(): {
+  count: number;
+  bytes: number;
+  evictableBytes: number;
+  pinnedBytes: number;
+  oldestAt: number | null;
+} {
+  return {
+    count: blobs.size,
+    bytes: blobBytes,
+    evictableBytes: blobEvictableBytes,
+    pinnedBytes: blobPinnedBytes,
+    oldestAt: blobOldestEvictableAt,
+  };
+}
+
+export function evictOldestCursorBlobForBudget(): number {
+  const now = Date.now();
+  let oldest: [string, CursorBlobEntry] | undefined;
+  for (const candidate of blobs) {
+    const entry = candidate[1];
+    if (entry.requestPins.size > 0) continue;
+    if (entry.provenance !== "local-regenerated" && !isExpired(entry, now)) continue;
+    if (!oldest || entry.storedAt < oldest[1].storedAt) oldest = candidate;
+  }
+  return oldest ? deleteBlob(oldest[0]) : 0;
+}
+
+export function setCursorBlobLimitsForTests(limits?: Partial<CursorBlobLimits>): void {
+  resetCursorBlobStateForTests();
+  blobLimits = limits ? { ...DEFAULT_BLOB_LIMITS, ...limits } : { ...DEFAULT_BLOB_LIMITS };
+}
+
+export function resetCursorBlobStateForTests(): void {
+  if (blobExpiryAccountingTimer) clearTimeout(blobExpiryAccountingTimer);
+  blobExpiryAccountingTimer = undefined;
+  blobs.clear();
+  blobRequestScopes.clear();
+  blobBytes = 0;
+  rejectedEntryTooLarge = 0;
+  rejectedPinnedSaturation = 0;
+  recomputeBlobClassAccounting();
+}
+
+export function cursorBlobStoreDebugSnapshotForTests(): Array<{
+  key: string;
+  sizeBytes: number;
+  storedAt: number;
+  provenance: CursorBlobProvenance;
+  requestPins: number;
+  dataDigest: string;
+  pinTokens: string[];
+}> {
+  return [...blobs].map(([blobKey, entry]) => ({
+    key: blobKey,
+    sizeBytes: entry.sizeBytes,
+    storedAt: entry.storedAt,
+    provenance: entry.provenance,
+    requestPins: entry.requestPins.size,
+    // Byte-for-byte content identity + exact pin-set membership so rollback
+    // tests can deep-compare complete state (review C1-2).
+    dataDigest: createHash("sha256").update(entry.data).digest("hex"),
+    pinTokens: [...entry.requestPins].map(scope => String(scope.description ?? "scope")).sort(),
+  }));
+}
+
 export async function handleCursorNativeExec(execMsg: ExecServerMessage, deps: CursorNativeExecContext = {}): Promise<Uint8Array[]> {
   const execCase = execMsg.message.case;
   if (execCase === "requestContextArgs") {
@@ -163,8 +494,8 @@ export async function handleCursorNativeExec(execMsg: ExecServerMessage, deps: C
   if (execCase === "grepArgs") return [grepExec(execMsg)];
   if (execCase === "shellArgs") return [shellExec(execMsg)];
   if (execCase === "shellStreamArgs") return shellStreamExec(execMsg);
-  if (execCase === "backgroundShellSpawnArgs") return [backgroundShellSpawnExec(execMsg)];
-  if (execCase === "writeShellStdinArgs") return [writeShellStdinExec(execMsg)];
+  if (execCase === "backgroundShellSpawnArgs") return [backgroundShellSpawnExec(execMsg, deps.sessionId ?? "")];
+  if (execCase === "writeShellStdinArgs") return [writeShellStdinExec(execMsg, deps.sessionId ?? "")];
   if (execCase === "fetchArgs") return [await fetchExec(execMsg, deps)];
   if (execCase === "mcpArgs" && execMsg.message.value.providerIdentifier === OCX_RESPONSES_TOOL_PROVIDER) {
     return [execBytes(execMsg, "mcpResult", create(McpResultSchema, {
@@ -199,9 +530,14 @@ export async function handleCursorNativeExec(execMsg: ExecServerMessage, deps: C
 }
 
 
-export function handleCursorNativeKv(kvMsg: KvServerMessage): Uint8Array {
+export function handleCursorNativeKv(
+  kvMsg: KvServerMessage,
+  requestScope?: CursorBlobRequestScopeToken,
+): Uint8Array {
   if (kvMsg.message.case === "getBlobArgs") {
-    const blobData = getBlob(key(kvMsg.message.value.blobId));
+    const blobKey = key(kvMsg.message.value.blobId);
+    const blobData = getBlob(blobKey);
+    if (blobData) releaseHydratedBlob(blobKey, requestScope);
     return clientBytes({
       message: {
         case: "kvClientMessage",
@@ -213,13 +549,25 @@ export function handleCursorNativeKv(kvMsg: KvServerMessage): Uint8Array {
     });
   }
   if (kvMsg.message.case === "setBlobArgs") {
-    setBlob(key(kvMsg.message.value.blobId), kvMsg.message.value.blobData);
+    const admission = setBlob(
+      key(kvMsg.message.value.blobId),
+      kvMsg.message.value.blobData,
+      "remote-setBlobArgs",
+      requestScope,
+    );
     return clientBytes({
       message: {
         case: "kvClientMessage",
         value: create(KvClientMessageSchema, {
           id: kvMsg.id,
-          message: { case: "setBlobResult", value: create(SetBlobResultSchema, {}) },
+          message: {
+            case: "setBlobResult",
+            value: create(SetBlobResultSchema, admission.admitted ? {} : {
+              error: create(ErrorSchema, {
+                message: "Cursor blob capacity is exhausted; the blob was not stored.",
+              }),
+            }),
+          },
         }),
       },
     });

package/src/adapters/cursor/protobuf-events.ts

@@ -13,6 +13,7 @@ import {
   responsesToolNameFromCursorWire,
 } from "./tool-definitions";
 import type { CursorServerMessage } from "./types";
+import type { TranslatorBudget } from "../../lib/translator-budget";
 
 const DEFAULT_CONTEXT_USAGE_MAX_ENTRIES = 200;
 const DEFAULT_CONTEXT_USAGE_TTL_MS = 60 * 60 * 1_000;
@@ -160,6 +161,7 @@ export interface CursorProtobufEventState {
   toolSchemas?: Map<string, unknown>;
   /** Cursor wire-name → original Responses/Codex tool name for this request. */
   cursorToolNameMap?: Map<string, string>;
+  translatorBudget?: TranslatorBudget;
 }
 
 export function createCursorProtobufEventState(options: {
@@ -174,6 +176,7 @@ export function createCursorProtobufEventState(options: {
    * the checkpoint tracker (#373).
    */
   estimatedInputTokens?: number;
+  translatorBudget?: TranslatorBudget;
 } = {}): CursorProtobufEventState {
   return {
     // Cursor provides no authoritative usage frame; token counts are heuristic estimates from
@@ -186,6 +189,7 @@ export function createCursorProtobufEventState(options: {
     startedClientToolCalls: 0,
     ...(options.toolSchemas ? { toolSchemas: options.toolSchemas } : {}),
     ...(options.cursorToolNameMap ? { cursorToolNameMap: options.cursorToolNameMap } : {}),
+    ...(options.translatorBudget ? { translatorBudget: options.translatorBudget } : {}),
     ...(options.contextUsage?.carryForwardTokens !== undefined ? { contextCarryForwardTokens: options.contextUsage.carryForwardTokens } : {}),
     ...(options.contextUsage?.recordContextTokens ? { recordContextTokens: options.contextUsage.recordContextTokens } : {}),
     ...(typeof options.estimatedInputTokens === "number"
@@ -363,6 +367,7 @@ function recordToolCall(state: CursorProtobufEventState, callId: string, cursorW
   // land on the tool Codex actually exposed this turn (#399).
   const mapKey = advertisedName ?? normalizeCursorWireName(cursorWireName);
   state.openToolCalls.set(callId, { name: responsesToolNameFromCursorWire(mapKey, state.cursorToolNameMap), args: "" });
+  state.translatorBudget?.openCall(callId);
   state.startedClientToolCalls++;
   return [];
 }
@@ -375,6 +380,7 @@ function recordToolCall(state: CursorProtobufEventState, callId: string, cursorW
  */
 function dropShellBridgeCall(state: CursorProtobufEventState, callId: string, toolName: string): CursorServerMessage[] {
   state.openToolCalls.delete(callId);
+  state.translatorBudget?.closeCall(callId);
   state.completedToolCalls.add(callId);
   return [{ type: "error", message: cursorShellBridgeDropError(toolName) }];
 }
@@ -386,6 +392,16 @@ function commitToolCall(state: CursorProtobufEventState, callId: string, finalAr
   if (!cursorShellBridgeArgsValid(finalArgs, open.name, schema)) {
     if (isCodexShellBridgeToolName(open.name)) return dropShellBridgeCall(state, callId, open.name);
   }
+  if (finalArgs !== open.args) {
+    const previousBytes = Buffer.byteLength(open.args);
+    const reservation = state.translatorBudget?.reserveTransient(
+      Buffer.byteLength(finalArgs),
+      { kind: "tool_args", callId },
+    );
+    open.args = finalArgs;
+    reservation?.commitRetained();
+    state.translatorBudget?.releaseRetained(previousBytes, { kind: "tool_args", callId });
+  }
   const out: CursorServerMessage[] = [{ type: "tool_call_start", id: callId, name: open.name }];
   if (finalArgs.length > 0) out.push({ type: "tool_call_delta", arguments: finalArgs });
   out.push(...endToolCall(state, callId));
@@ -401,12 +417,23 @@ function commitToolCall(state: CursorProtobufEventState, callId: string, finalAr
 function bufferToolArgs(state: CursorProtobufEventState, callId: string, cumulative: string): void {
   const open = state.openToolCalls.get(callId);
   if (!open) return;
-  if (cumulative.length >= open.args.length) open.args = cumulative;
+  if (cumulative.length >= open.args.length) {
+    const encoder = new TextEncoder();
+    const previousBytes = encoder.encode(open.args).byteLength;
+    const reservation = state.translatorBudget?.reserveTransient(
+      encoder.encode(cumulative).byteLength,
+      { kind: "tool_args", callId },
+    );
+    open.args = cumulative;
+    reservation?.commitRetained();
+    state.translatorBudget?.releaseRetained(previousBytes, { kind: "tool_args", callId });
+  }
 }
 
 function endToolCall(state: CursorProtobufEventState, callId: string): CursorServerMessage[] {
   if (!state.openToolCalls.has(callId)) return [];
   state.openToolCalls.delete(callId);
+  state.translatorBudget?.closeCall(callId);
   state.completedToolCalls.add(callId);
   return [{ type: "tool_call_end", id: callId }];
 }